1 This is the textual form of the GOsa FAQ. Online information with
2 comments is set up at Wiki: http://oss.gonicus.de/gosa/.
4 Q: When creating many users for one department, I need to fill some
5 fields again and again. Is there a shortcut for that?
7 A: Just create a user template and pre-fill all values you need. You
8 can use dynamic content, too: uid, sn and givenName will be replaced.
9 i.E. an entry '/home/%uid' in homeDirectory will be replaced by the
10 real uid of the user you're creating, %sn.%givenName@yourdomain.com
11 creates proper email addresses, etc. Templates include group membership.
14 Q: Can GOsa execute commands after creating/editing/removing users,
15 departments, etc.
17 A: Yes. Edit /etc/gosa/gosa.conf's menu section. Each plugin may have
18 an entry "postremove", "postmodify" and "postcreate". You can use
19 ldap attributes as command line options.
20 i.E. postcreate="/usr/bin/sudo /usr/local/sbin/ftp.setperms %uid '%givenName'"
23 Q: I'd like to modify the look of GOsa to fit our CI. How can I create an
24 own theme?
26 A: Themes are splitted into two parts. ihtml/ contains templates which
27 generate the ui, html/ contains all parts that must be readable from
28 clients. GOsa first looks for predefined files in the directory indirectly
29 defined via the "theme" parameter in /etc/gosa/gosa.conf. If it can't
30 find them here, it'll use the default one.
32 So start over by copying html/themes/default to html/themes/yourtheme
33 and ihtml/themes/default to ihtml/themes/yourtheme. Change gosa.conf to
34 contain theme="yourtheme" in section main. Here are some files to edit:
36 * login.tpl -> login screen
37 * framework.tpl -> page contents
38 * style.css -> stylesheets used by GOsa
40 In fact, the rest of the UI is not converted to smarty, yet. Please be
41 patient.
44 Q: How can I let a person do administrative tasks under a specific department?
46 A: Create a group inside this department. Put all administrative people inside,
47 go to the "ACL" tab and check all fields these users should be able to adminstrate.
50 Q: How can I permit users to change some of their own attributes?
52 A: Same like the point above, but this rule only works for users own attributes
53 by checking the box on the acl page.
56 Q: What about applications?
58 A: GOsa can manage desktop applications in ldap. Create a group and put all users
59 in there, which have common desktop settings. Go to the "Application" tab and
60 add all applications common to this group. Applications can be created from the
61 application plugin.
62 The idea behind this feature is a script running on the terminal-servers/
63 workstation which check for applications on login (or on a regular basis using
64 timestamps). This one will create the corresponding icons on your KDE or GNOME
65 desktop.
68 Q: What's this terminal stuff?
70 A: GOto is - similar to LTSP - a ldap based diskless client system. It is available
71 from our projects page.
74 Q: I can't select any mailservers. What's wrong?
76 A: LDAP stores information about all your servers. The server plugin is not ready
77 yet, so you've to adjust/add these entries using your favorite ldap tool.
80 Q: GOsa is not in my native language, can I translate it to my language?
82 A: Yes. Just go to the locale directory and copy the messages.po file somewhere
83 else. Edit the copy and put your translations into the msgstr lines. To be
84 included in next GOsa releases, you may want to send it to the GOsa maintainer.
85 Finally you need to create a directory with your language code. (i.e. de for
86 german) containing the LC_MESSAGES directory. Move your messages.po file there
87 and run 'msgfmt messages.po' in that directory. That's it.
89 You may need to restart apache, depending on your setup. On Debian, be sure
90 to have your locale generated (dpkg-reconfigure locales) before.
93 Q: The online help doesn't exist in my language, can i translate it to my language?
95 A: Yes. Just go to the doc/guide/user/en directory and copy the lyx-source directory
96 to a new directory in doc/guide/user/<your language>. You have to use the lyx
97 program create the online help in your language. When you have finish just run
98 ./gen_online_help from the gosa root directory to generate the online docs.
101 Q: Can I specify some kind of password policies?
103 A: You can place the keywords "pwminlen" and "pwdiffer" in the main section of your
104 gosa.conf. "pwminlen" specifies how many characters a password must have to be
105 accepted. "pwdiffer" contains the number of characters that must be different
106 from the previous password.
108 Note that these only affect passwords that are set by the user, not by the admins.
111 Q: I've to update passwords on external windows PDCs. Can I add a command to let
112 synchronize these for me?
114 A: There's the possibility to add a password hook in gosa.conf's main section using
115 the keyword "externalpwdhook". The specified command will be executed with
116 three parameters: /path/to/your/script username oldpassword newpassword
118 So you can call i.e. smbpasswd to handle your password change on the PDC.
121 Q: What about templates for vacation messages?
123 A: Create a directory to keep a set of vacation messages which are readable by the
124 user that runs your apache. In this example I'll use /etc/gosa/vacation for that.
126 Put your vacation files in there containing a "DESC:some descriptive text" as the
127 first line followed by the normal vacation text. You can use all attributes from
128 the generic tab. I.e.:
130 /etc/gosa/vacation/business.txt ------------------------------------------------->8
131 DESC:Away from desk
132 Hi, I'm currently away from my desk. You can contact me on
133 my cell phone via %mobile.
135 Greetings,
136 %givenName %sn
137 -----------------------------------------------------------------------------------
139 Place the config option vacationdir="/etc/gosa/vacation" in the location found in
140 gosa.conf and a template box is show in the vacation mail tab.
143 Q: How can I generate automatic ID's for user templates?
145 A: Add an entry describing your id policy in gosa.conf, location section:
147 a) using attributes
148 You can specify LDAP attributes (currently only sn and givenName) in braces {}
149 and add a percent sign befor it. Optionally you can strip it down to a number
150 of characters, specified in []. I.e.
152 idgen="{%sn}-{%givenName[2-4]}"
154 will generate an ID using the full surename, adding a dash, and adding at least
155 the first two characters of givenName. If this ID is used, it'll use up to four
156 characters. If no automatic generation is possible, a input box is shown.
158 b) using automatic id's
159 I.e. specifying
161 idgen="acct{id:3}"
163 will generate a three digits id with the next free entry appended to "acct".
165 idgen="ext{id#3}"
167 will generate a three digits random number appended to "ext".
170 Q: I'm migrating from the current LDAP, now GOsa does not allow uid's and group
171 with upper/lower case and spaces. What can I do?
173 A: Include the strict="no" keyword in your gosa.conf's location section.
174 WARNING: using strict="no" will cause problems with cyrus/postfix!!
177 Q: I'd like to place my users under ou=staff, not under ou=people. Can I change
178 this?
180 A: Yes. You can change the people and group locations by adding the following
181 statements to your location sections:
183 people="ou=staff"
184 groups="ou=crowds"
186 After logging in again, people and groups are created in the configured places.
187 As a side note, you can leave these strings blank for flat structures, too.
190 Q: I've problems with many objectClass violations/undefined attributes. Can GOsa
191 check what's missing?
193 A: Yes. Move away your gosa.conf and go to the GOsa setup. Follow the steps till
194 you can download the config. If you get up to this point, your schema is ok...
197 Q: I really don't want dn's containing the CN for user accounts because I don't
198 want to support anonymous binds for uid resolution. Is it possible to have dn's
199 containing the uid instead?
201 A: Yes. Placing the dnmode="uid" keyword in your gosa.conf's location section will
202 solve your problem.
205 Q: Hey, I've installed GOsa, but it claims something about "SID and / or RIDBASE
206 are missing in your configuration". What's wrong?
208 A: You've configured GOsa to use samba3, but your LDAP has no samba domain object
209 inside. Either log into samba for the first time to let it create that object,
210 or supply the sid and ridbase for your domain in your gosa.conf's location, i.e.:
212 <location name=...>
213 ...
214 ridbase="1000"
215 sid="0-815-4711" \>
217 Remember to fill in your real domain sid which is retrievable by the command
218 "net getlocalsid".
221 Q: We have massive performance problems with using samba as a member server.
223 A: This is a known issue. We're working around this by putting
225 <location name=...>
226 ...
227 sambaidmapping="true"
228 ... \>
230 into the configuration. GOsa will write the additional objectClass sambaIdmapEntry
231 to the group and user objects.
234 Q: I get 'The value specified as GID/UID number is too small' when forcing IDs. Why?
236 A: This is an additional security feature, so that no one can fall back to uid 0. The
237 default minimum ID is 100. You can set it to every value you like by specifying
239 <location name=...>
240 ...
241 minid="40"
242 ... \>
244 in your configuration. In this example 40 will be the smallest ID you can enter.
247 Q: I've saved my windows workstations in other locations like GOsa is doing it
248 for decades. Is there a way to change this?
250 A: Yes. Use the winstation parameter in your location section:
252 <location name=...>
253 ...
254 winstations="ou=machineaccounts"
255 ... \>
258 Q: GOsa doesn't seem to follow my referrals. What can I do?
260 A: Place the option 'recursive = "true"' inside your locations definition
261 and you should be fine.
264 Q: I'd like to have TLS based LDAP connections from within GOsa. Is this possible?
266 A: Yes, add
268 <location ...>
269 ...
270 tls="true"
271 ... \>
273 to the location section of GOsa. This switch affects LDAP connections for a single location only.
276 Q: Cyrus folder get created in the style user.username. I prefer the unix hirachy
277 style user/username. Is it possible to change this?
279 A: Yes, add
281 <main ...>
282 ...
283 cyrusunixstyle="true"
284 ... \>
286 to the main section of GOsa and the folders are created in unix style.
289 Q: I'd like to do special checks for several plugin parameters. How can I modify
290 GOsa to take care of these checks?
292 A: No need to modify anything. Just add a hook the the plugin you'd like to
293 check:
295 check="/your/command/binary"
297 This binary will get an ldif to STDIN for analysis and may write an error message
298 to STDOUT. Note, that the supplied ldif may NOT be the original target ldif due
299 to technical reasons.
302 Q: Is there a way to use ACL independet filtering when using administrative units?
304 A: Yes. Set STRICT_UNITS to "true" in your gosa.conf's location section.
307 Q: How can i active the account expiration code for the gosa interface?
309 A: Yes. Just set "account_expiration" to "true" in your gosa.conf's main section.
312 Q: What is the correct connection string for a Kolab server in GOsa?
314 A: Try {localhost:143/novalidate-cert}.
317 Q: Sieve is not working from GOsa - there are authentication problems
318 with this service, IMAP/POP is working. What's wrong?
320 A: Verify that the paramater sasl_auto_transition: no is not
321 present in your imap.conf
324 Q: Slapd does not start with kolab2.schema included. It claims that the
325 definition of calFBURL is missing. What can I do?
327 A: For Kolab to work correctly you have to include the rfc2739.schema
328 in your slapd.conf. Insert it before the kolab2.schema
331 Q: Is there a way to let GOsa automatically fill missing fields in the network
332 configuration?
334 A: Sure. You can specify the "auto_network_hook" option and provide the contributed
335 script "net-resolver.sh" in your gosa.conf. If this is configured, you're
336 getting an additional button in each network dialog.
339 Q: New implementations of OpenLDAP seem to require {sasl} instead of {kerberos}
340 in password hashes. GOsa writes the wrong string. What can I do?
342 A: You can set "krbsasl" to "true" in your gosa.conf's main section.
345 Q: Is there a way to add the personalTitle attribute the the users dn?
347 A: Just add this line into the location section of your gosa.conf.
348 <location name=...
349 include_personal_title="true"
350 ...>
353 Q: I'd like to assign different uid bases for certain user/group objects.
354 How can this be achieved?
356 A: Use the base_hook in your gosa.conf's location section to specify a script
357 which handles the ID generation externaly. It get's called with the "dn"
358 and the attribute to be ID'd. It should return an integer value.
361 Q: I'd like to use rfc2307bis compliant groups. Is this possible?
363 A: Yes - place the rfc2307bis="true" inside of the location section of
364 your gosa.conf. Remember, that you can't create empty groups in this mode.
367 Q: Can GOsa show some vendor information for given MAC addresses?
369 A: Yes. Download http://standards.ieee.org/regauth/oui/oui.txt and place
370 it in /etc/gosa/oui.txt.
373 Q: GOsa sessions expire too quick. Is there a way to change this?
375 A: Yes. Set "session_lifetime" to the number of seconds of inactivity. 7200
376 (60x60x2) would be for two hours. Place this option inside the main
377 section of your gosa.conf.
380 Q: Microsoft Internet Explorer <=6 paints strange blocks around images.
381 What's up with this?
383 A: Use Firefox, Konqueror, Safari, Opera, IE >= 7, etc. IE is broken and
384 I don't want to waste my time with working around this old crap. There's
385 a quick hack, if you just put "ie_png_workaround='true'" inside the main
386 section of your gosa.conf. This is a JavaScript based workaround and I've
387 to place a WARNING here: it is damn slow if you've large lists to display.
389 If you have much time, you can provide a seamless integration with MS
390 filter css extension.
393 Q: Is there a way to let users change passwords without logging into GOsa?
395 A: Yes. Browse to "password.php". You can preset a couple of things i.e.:
397 http://your.admin.server/password.php?uid=cajus&method=md5&directory=GONICUS+GmbH
400 Q: GOsa only shows 300 entries at a time. Is this normal?
402 A: There's a default sizelimit. You can set the "sizelimit" option in your
403 gosa.conf's location section to a higher value to get rid of it.
406 Q: Is it possible to see some kind of information about how many objects
407 get shown in the list I'm currently looking at?
409 A: Just add "list_summary = 'true'" inside the main section of your gosa.conf.
412 Q: Is it possible to login with the users mail address too?
414 A: Yes, just add the following line to your gosa.conf:
415 <location ...
416 auth_mail="true"
417 ...>
420 Q: I want to use cyrus for multiple mail domains, but GOsa uses the 'uid' attribute
421 for account names, how do I change this to 'mail'?
423 A: Just add/modify the following line to/in your gosa.conf:
424 <location ...
425 mail_uattrib="mail"
426 ...>
428 Q: When creating mail group with a Kolab server i got this error message
429 "Object class violation (invalid structural object class chain (posixGroup/kolabSharedFolder)"
431 A: In your kolab2.schema objectclass kolabSharedFolder change
432 'SUP top STRUCTURAL' to 'SUP top AUXILIARY'